Juniper Secure Analytics SETTING UP A JSA SERVER Release 2014.1 Juniper Networks, Inc. 1194 North Mathilda Avenue Sunnyvale, CA 94089 USA 408-745-2000 www.juniper.net Published: 2014-03-14
Copyright Notice Copyright 2014 Juniper Networks, Inc. All rights reserved. Juniper Networks, Junos, Steel-Belted Radius, NetScreen, and ScreenOS are registered trademarks of Juniper Networks, Inc. in the United States and other countries. The Juniper Networks Logo, the Junos logo, and JunosE are trademarks of Juniper Networks, Inc. The following terms are trademarks or registered trademarks of other companies: Java TM and all Java-based trademarks and logos are trademarks or registered trademarks of Oracle and/or its affiliates. All other trademarks, service marks, registered trademarks, or registered service marks are the property of their respective owners. All specifications are subject to change without notice. Juniper Networks assumes no responsibility for any inaccuracies in this document or for any obligation to update information in this document. Juniper Networks reserves the right to change, modify, transfer, or otherwise revise this publication without notice. FCC Statement The following information is for FCC compliance of Class A devices: This equipment has been tested and found to comply with the limits for a Class A digital device, pursuant to part 15 of the FCC rules. These limits are designed to provide reasonable protection against harmful interference when the equipment is operated in a commercial environment. The equipment generates, uses, and can radiate radio-frequency energy and, if not installed and used in accordance with the instruction manual, may cause harmful interference to radio communications. Operation of this equipment in a residential area is likely to cause harmful interference, in which case users will be required to correct the interference at their own expense. The following information is for FCC compliance of Class B devices: The equipment described in this manual generates and may radiate radio-frequency energy. If it is not installed in accordance with Juniper Networks installation instructions, it may cause interference with radio and television reception. This equipment has been tested and found to comply with the limits for a Class B digital device in accordance with the specifications in part 15 of the FCC rules. These specifications are designed to provide reasonable protection against such interference in a residential installation. However, there is no guarantee that interference will not occur in a particular installation. If this equipment does cause harmful interference to radio or television reception, which can be determined by turning the equipment off and on, the user is encouraged to try to correct the interference by one or more of the following measures: Reorient or relocate the receiving antenna. Increase the separation between the equipment and receiver. Consult the dealer or an experienced radio/tv technician for help. Connect the equipment to an outlet on a circuit different from that to which the receiver is connected. Caution: Changes or modifications to this product could void the user's warranty and authority to operate this device. Disclaimer THE SOFTWARE LICENSE AND LIMITED WARRANTY FOR THE ACCOMPANYING PRODUCT, SUBJECT TO THE MODIFICTAIONS SET FORTH BELOW ON THIS PAGE, ARE SET FORTH IN THE INFORMATION PACKET THAT SHIPPED WITH THE PRODUCT AND ARE INCORPORATED HEREIN BY THIS REFERENCE. IF YOU ARE UNABLE TO LOCATE THE SOFTWARE LICENSE OR LIMITED WARRANTY, CONTACT YOUR JUNIPER NETWORKS REPRESENTATIVE FOR A COPY. Setting Up a JSA Update Server Release 2014.1 Copyright 2014, Juniper Networks, Inc. All rights reserved. Printed in USA. Revision History March 2014 Setting Up a JSA Update Server The information in this document is current as of the date listed in the revision history. END USER LICENSE AGREEMENT The Juniper Networks product that is the subject of this technical documentation consists of (or is intended for use with) Juniper Networks software. Use of such software is subject to the terms and conditions of the End User License Agreement ( EULA ) posted at http://www.juniper.net/support/eula.html, as modified by the following text, which shall be treated under the EULA as an Entitlement Document taking precedence over any conflicting provisions of such EULA as regards such software: As regards software accompanying the STRM products (the Program ), such software contains software licensed by Q1 Labs and is further accompanied by third-party software that is described in the applicable documentation or materials provided by Juniper Networks. 2
For the convenience of Licensee, the Program may be accompanied by a third party operating system. The operating system is not part of the Program, and is licensed directly by the operating system provider (e.g., Red Hat Inc., Novell Inc., etc.) to Licensee. Neither Juniper Networks nor Q1 Labs is a party to the license between Licensee and the third party operating system provider, and the Program includes the third party operating system AS IS, without representation or warranty, express or implied, including any implied warranty of merchantability, fitness for a particular purpose or non-infringement. For an installed Red Hat operating system, see the license file: /usr/share/doc/redhat-release-server-6server/eula. By downloading, installing or using such software, you agree to the terms and conditions of that EULA as so modified. 3
4
CONTENTS 1 SETTING UP A JSA UPDATE SERVER Configuring your Update Server......................................... 7 Adding New Updates................................................. 10
1 SETTING UP A JSA UPDATE SERVER If your deployment includes a Juniper Secure Analytics (JSA) console that is unable to access the Internet or you want to manually manage updates to your system, you can set up a JSA update server to manage the update process. JSA uses system configuration files to provide useful characterizations of network data flows. Updates to the system configuration files, available on the website (www.juniper.net/customers/support/), include minor updates (such as Online Help or script updates), major updates (such as JAR file updates), or Device Service Module (DSM) updates. Updates also include threat, vulnerability, and geographic information from various security-related websites.the JSA console must be connected to the Internet to receive automatic updates. The autoupdate package includes all files necessary to manually set up an update server in addition to the necessary system configuration files for each update. After the initial setup, you only need to download and uncompress the most current autoupdate package to manually update your configuration. To receive notification of new updates, access Juniper Customer Support and subscribe to the following page: Software > Autoupdates. This technical note provides information on manually setting up your JSA update server. Unless otherwise noted, all references to JSA refer to JSA and Log Analytics. References to flows do not apply to Log Analytics. Configuring your Update Server You can either configure an Apache server or your JSA console as your update server. Procedure to configure the Apache Server Step 1 Step 2 Access your Apache server. Create an update directory named software/jsa/autoupdate/. By default, the update directory is located in the web root directory of the Apache server. You can place the directory in another location if you configure JSA accordingly. For more information, see the Juniper Secure Analytics Administration Guide. Setting Up a JSA Update Server
8 SETTING UP A JSA UPDATE SERVER Step 3 Step 4 Step 5 Step 6 Optional. Create an Apache user account and password to be used by the update process. Download the autoupdate package from the Juniper Customer Support website. a b c d Go the Juniper Customer Support website www.juniper.net/customers/support/ Select Software > Autoupdates. Double-click the latest autoupdate package matching your JSA version. Save the file on your Apache server in the autoupdates directory created in Step 2. On the Apache server, type the following command to uncompress the autoupdate package. tar -zxf updatepackage-[timestamp].tgz Configure JSA to accept updates: a Click the Admin tab. b On the navigation menu, click System Configuration. c d Click Auto Update. To direct the update process to the Apache server, configure the following parameters in the Server Configuration panel: Webserver - Type the address or directory path of the Apache server. Note: If the Apache server runs on non-standard ports, add :<portnumber> to the end of the address. For example, www.juniper.net/customers/support/:8080. Directory - Type the directory location you created in Step 2. Proxy Information - Optional. If proxy information is required to access the Apache server, configure the following parameters: - Proxy Server - Type the URL for the proxy server. - Proxy Port - Type the port for the proxy server. - Proxy Username - Type the necessary username for the proxy server. A username is only required if you are using an authenticated proxy. - Proxy Password - Type the necessary password for the proxy server. A password is only required if you are using an authenticated proxy. e Select the Deploy changes check box. f g Click Save. Using SSH, Log in to JSA as the root user. Username: root Password: <admin password> Setting Up a JSA Update Server
Configuring your Update Server 9 h i To configure the username and password for the Apache server, type the following commands: /opt/qradar/bin/updateconfs.pl -change_username <username> /opt/qradar/bin/updateconfs.pl -change_password <password> The username and password must match those created in Step 3. To test your update server, type the following command: lynx https://<your update server>/<directory path to updates>/manifest_list j Type the username and password created in Step 3. What to do next If the list of updates is not displayed, contact Juniper Customer Support. Procedure to configure your JSA Console as the Update Server Step 1 Step 2 Step 3 Step 4 Step 5 Log in to JSA as the root user. Username: root Password: <admin password> Type the following command to create the autoupdate directory: mkdir /opt/qradar/www/software/jsa/autoupdate/ Download the autoupdate package from the Juniper Customer Support website. a b c Go the Juniper Customer Support website www.juniper.net/customers/support/ Select Software > Autoupdates. Double-click the latest autoupdate file matching your JSA version. d Save the file on your JSA console in the autoupdates directory created in Step 2. On your JSA console, type the following command to uncompress the autoupdate package. tar -zxf updatepackage-[timestamp].tgz Configure JSA to accept updates: a Log in to the JSA user interface. b Click the Admin tab. c On the navigation menu, click System Configuration. d e Click the Auto Update icon. In the Server Configuration pane, type https://localhost/ in the Webserver field. Setting Up a JSA Update Server
10 SETTING UP A JSA UPDATE SERVER Step 6 f If the Send feedback option in the Update Settings pane is enabled, clear the check box to disable it. Click Save and Update Now. Adding New Updates After you have configured your update server and set up JSA to receive updates from the update server, adding new updates only requires you to download updates from the Juniper Customer Support website to your update server. Step 1 Step 2 Step 3 Step 4 Step 5 Step 6 Procedure to add new updates to the server: Download the update file from the Juniper Customer Support website. a b c Go the Juniper Customer Support website www.juniper.net/customers/support/ Select Software > Autoupdates. Double-click the latest autoupdate package matching your JSA version. d Save the file on your local update server in the directory you created when setting up your update server. Access your update server. Type the following command to uncompress the autoupdate package: tar zxf <updatepackage.tgz> Log in to JSA as root. Test your update server, type the following command: lynx https://<your update server>/<directory path to updates>/manifest_list Type the username and password of your update server. What to do next If the list of updates is not displayed, contact Juniper Customer Support. Setting Up a JSA Update Server